OS release
Shows Linux distribution and version.
Risk: Old or unsupported systems may miss security patches.
MANAGED SERVER SECURITY · HONEST PARTNER POSITIONING
Managed protection for websites, APIs and VPS servers
Server Warden audits, installs, configures and monitors autonomous cyber defense for small and mid-sized businesses. The technology layer is powered by E-ZETTA Safe Guard.
No deception: Server Warden is an implementation and managed security service. E-ZETTA Safe Guard is the autonomous defense technology layer.
Free read-only server check
Nginx / SSH / VPS visibility
Telegram alerts and reports
Managed setup and support
Most businesses do not see attacks until something breaks
Bots scan login pages, hidden files, API endpoints and server ports every day. A small business usually has logs, but no one reads them. Server Warden turns that blind spot into a clear risk report and a managed protection plan.
No visibility
You may have nginx logs, SSH logs and firewall rules, but no readable security picture.
No time
Owners and developers are busy building the business, not watching attacks 24/7.
No response flow
Even if an attack is detected, someone still needs to decide what to block, what to alert, and what to investigate.
What Server Warden delivers
A practical service, not just software access.
01
Server audit
External domain check plus optional read-only Linux audit script for nginx, SSH, ports, firewall state, exposed paths, package age and risky configuration signals.
02
Managed installation
We install and configure the protection layer, connect monitored assets, tune initial rules and verify the first heartbeat and alerts.
03
Autonomous defense layer
Continuous threat detection and SIEM-style correlation, with Gatekeeper auto-ban decisions and Telegram alerts, powered by E-ZETTA Safe Guard.
04
Reports and support
Readable weekly or monthly reports: what was scanned, what was blocked, what changed, and what should be improved next.
Technology foundation
The E-ZETTA Safe Guard product overview describes an autonomous platform with self-writing rules, self-healing, federated peers, 16 security engines, a 25-module detection pipeline, ML/Neural AI, SIEM, SOAR, Gatekeeper, threat intelligence and Telegram notification components.
16 engines25-module pipelineML + Neural AISIEM / SOARGatekeeperSelf-healing
Free Server Check
Start with facts, not fear.
The first step is a safe diagnostic report. The audit utility will be read-only: it will not change firewall rules, will not ban IPs, will not edit nginx, and will not upload secrets without explicit consent.
CLI
Run the read-only server audit
Copy this command and run it on your Linux server. The script creates a local HTML/TXT report and does not upload secrets.
curl -fsSL https://serverwarden.pro/check.sh | sudo bashNew here? Open the script first, it is plain readable bash with nothing hidden, before piping anything into sudo.
Want to know what these checks mean? What is a read-only audit · server security glossary · VPS security checklist · SSH hardening guide
SCAN
Full audit checklist
Below is the complete current list of read-only checks performed by the server audit script, with a short explanation of why each item matters.
44 checks total
Critical · 12Warning · 23Informational · 9
Kernel
Shows kernel version and architecture.
Risk: Old kernels can contain known privilege-escalation vulnerabilities.
Uptime / load
Shows uptime and current load.
Risk: Very long uptime can mean updates were installed but never activated by reboot.
Disk usage
Shows filesystem usage and free space.
Risk: Full disks can break databases, logs, backups and web services.
Memory / swap
Shows RAM and swap usage.
Risk: Memory pressure can cause crashes, slowdowns and killed services.
Package update signal
Counts packages that appear upgradable.
Risk: Many outdated packages may mean known vulnerabilities remain unpatched.
fail2ban status
Checks whether fail2ban exists and is active.
Risk: Without rate limiting, brute-force attempts can continue endlessly.
Top CPU processes
Shows the highest CPU-consuming processes.
Risk: Unexpected CPU usage can reveal miners, loops or abuse.
Suspicious process indicators
Looks for known suspicious names and paths like xmrig, kinsing, /tmp and /dev/shm.
Risk: These indicators may point to malware or unauthorized tools.
Listening TCP sockets
Lists services listening on network ports.
Risk: Unexpected open ports increase the attack surface.
Public SSH exposure
Checks whether SSH appears exposed on public interfaces.
Risk: Public SSH attracts brute-force attacks and credential probing.
Docker TCP API
Checks for Docker API port 2375.
ss -tulpen | grep ':2375'
Risk: Exposed Docker API can allow full host takeover.
Database/service ports
Looks for common DB ports like MySQL, PostgreSQL, Redis, Elasticsearch and MongoDB.
Risk: Public databases are frequent targets for theft, ransom and destruction.
UFW status
Checks UFW firewall state and rules.
Risk: Inactive firewall may leave services exposed.
nftables ruleset
Shows a short nftables rules summary.
Risk: Missing or weak rules can expose internal services.
iptables rules
Shows a short iptables rules summary.
Risk: Conflicting or empty rules can create false sense of protection.
SSH failed-login signals
Counts failed passwords, invalid users and authentication failures.
Risk: High failure volume means the server is being attacked or probed.
Top SSH auth source IPs
Shows most active IPs from failed SSH authentication.
Risk: Repeated sources may need blocking, rate limits or VPN-only access.
SSH effective configuration
Checks root login, password auth, empty passwords and key settings.
Risk: Weak SSH config is one of the fastest ways to lose a server.
UID 0 users
Finds root-equivalent accounts.
awk -F: '$3==0 {print $1}' /etc/passwd
Risk: Extra UID 0 users can be hidden backdoor admin accounts.
sudo/admin group members
Shows users with elevated admin group membership.
Risk: Too many admins increases damage from stolen accounts.
authorized_keys permissions
Checks SSH key files and risky writable permissions.
find /root /home -maxdepth 3 -name authorized_keys -perm /022
Risk: Writable key files can let attackers add their own login keys.
nginx version
Shows installed nginx version.
Risk: Old nginx versions may contain known bugs or missing hardening features.
nginx config test
Runs nginx configuration validation.
Risk: Broken config can prevent reloads, SSL renewal or emergency fixes.
Suspicious nginx log patterns
Looks for .env, .git, wp-config, xmlrpc, traversal, SQLi-like and shell-like requests.
Risk: These requests often indicate automated vulnerability scanning.
Top suspicious nginx paths
Shows the most common suspicious requested paths.
Risk: Repeated paths show what attackers are trying to exploit.
nginx server inventory
Lists server_name, root, proxy_pass, listen and certificate directives.
Risk: Helps find forgotten sites, wrong roots and risky proxy exposure.
nginx risky directives
Checks for directives like autoindex on and server_tokens on.
nginx -T | grep -iE 'autoindex\s+on'
Risk: Directory listing and version exposure can leak useful attack information.
Docker socket permissions
Checks Docker socket permissions.
ls -l /var/run/docker.sock
Risk: Access to docker.sock often equals root-level control of the host.
Docker containers
Lists running containers, images, ports and status.
Risk: Forgotten containers can expose old apps or vulnerable services.
Docker privileged/network risk
Detects privileged containers, host networking and risky binds.
Risk: Privileged containers can break isolation and compromise the host.
Sensitive file path markers
Finds paths like .env, .git, wp-config.php and config.php without reading secrets.
Risk: If exposed through web root, these files can leak credentials.
World-writable project files
Finds project files and directories writable by everyone.
Risk: World-writable paths can allow tampering, web shells or persistence.
Executable files in temp dirs
Finds executable files in /tmp, /var/tmp and /dev/shm.
Risk: Malware often runs from temporary directories.
SUID files snapshot
Creates a snapshot of SUID binaries on the root filesystem.
Risk: Unexpected SUID binaries can enable privilege escalation.
Cron jobs
Shows cron inventory and risky patterns like curl|bash, /tmp, base64, nc and socat.
Risk: Malicious cron jobs are a common persistence technique.
Failed systemd services
Lists failed services.
Risk: Failed security, backup or web services can hide real incidents.
Suspicious systemd Exec lines
Looks for risky startup commands in systemd units.
Risk: Systemd units can be used to restart malware after reboot.
Recent backup files
Lists recent files in /opt/backups when present.
Risk: No visible backups means recovery may fail after an incident.
Backup freshness
Checks whether /opt/backups has recent files from the last 3 days.
Risk: Old backups may be useless after ransomware, deletion or bad deploys.
Let's Encrypt certificates
Shows certificate subjects and expiry dates.
Risk: Expired certificates break trust, checkout flows and APIs.
Disk pressure
Flags high or critical filesystem usage.
Risk: Disk pressure can stop logs, databases, backups and deployments.
Local HTML/TXT report
Creates report.html and report.txt locally on the server.
Risk: Without a report, the client cannot clearly see risk or next steps.
Risk score and recommendations
Summarizes findings into a risk score with recommendations.
Risk: A score helps prioritize fixes instead of guessing.
Run these checks on your own serverOne command covers everything above and writes a local report in under a minute.
Jump to the audit commandSafety: the script is read-only. It does not change firewall rules, does not delete files, does not ban IPs and does not upload secrets.
1
External domain scan
Checks HTTPS, TLS, headers, visible CMS signals, exposed paths and public endpoints from the outside.
2
Optional read-only server audit
Checks nginx/SSH logs, failed login volume, suspicious paths, open ports, firewall state, cron/systemd signals and backup indicators.
3
Clear report
Outputs a risk score, critical/high/medium findings and a recommendation: leave as-is, harden manually, or install managed autonomous protection.
Example report snapshot
High risk · action recommended
74
Risk score / 100, higher = more urgentCritical
SSH is exposed publicly and has repeated failed login attempts.
Requests to /.env, /.git/config and wp-config.php were detected.
Firewall is not active or has no meaningful rules.
High
No visible rate limit for login endpoints.
Security headers are incomplete.
Run this on your own serverWhat you get
Server Warden sells implementation, configuration, monitoring and support. We do not pretend to be the original vendor of the E-ZETTA Safe Guard technology. We package the result for the customer: protected server, readable reports and a support path.
- Server audit
- Managed installation
- Autonomous defense layer
- Reports and support
Utility principle: read-only first, explicit consent before any upload, no automatic system changes during the free audit.
How the client journey works
Free check
We show the client what is happening around their server and website.
Action plan
We explain what should be fixed manually and what should be covered by managed protection.
Deployment
We install the protection layer, connect alerts, verify health and document rollback.
Daily protection
You receive alerts, summaries, reports and support instead of raw logs that are hard to understand quickly.
Server security guides
Practical, source-backed guides and a glossary on Linux server and VPS security, from SSH hardening to backups.
SSH Hardening: Best Practices Against Brute-Force Attacks
Keys, sshd_config settings, ciphers and firewall rules.
VPS Security Checklist: The Complete Guide
SSH, firewall, patching, monitoring and incident response end to end.
How to Stop SSH Brute-Force Attacks on a VPS
Measure the attack, add layers, prove each one works.
Fail2ban Setup Guide: Jails, Filters and Ban Times
Automated intrusion prevention, configured correctly.
Linux Firewall Guide: iptables vs nftables vs ufw
Pick and configure the right host firewall.
VPS Backup Strategy: 3-2-1 Rule, Immutable Copies, Restores
What to back up, and how to prove it restores.
Frequently asked questions
What is managed server security?
Server Warden audits, installs, configures and monitors protection for websites, APIs and VPS servers, then sends alerts and readable reports, so a small business does not have to watch attacks around the clock.
What does the free server check do?
It runs an external scan of HTTPS, TLS, headers, visible CMS signals, exposed paths and public endpoints, plus an optional read-only Linux audit script, and returns a risk score with a recommendation: leave as is, harden manually, or install managed protection.
Does the audit change anything on my server?
No. The audit is read-only first: it does not change firewall rules, ban IPs or edit nginx, and it does not upload secrets without explicit consent.
Who is Server Warden for?
Small and mid-sized businesses that run websites, APIs or VPS servers and want protection and readable reports without building a security team.
Is Server Warden the vendor of the underlying technology?
No. Server Warden sells implementation, configuration, monitoring and support. The technology layer is powered by E-ZETTA Safe Guard, and we package the result for the customer: a protected server, readable reports and a support path.
Have questions about the audit?
Instant answers from our technical documentation. For a person, use the chat widget below.